From 220b0356be08906dac6ccaa9ba6cf9e0289b3435 Mon Sep 17 00:00:00 2001 From: jsing <> Date: Sun, 31 May 2026 14:34:44 +0000 Subject: Clean up signature algorithm handling. Now that we no longer support TLSv1.0 and TLSv1.1, SSL_USE_SIGALGS() is always true - remove all of the code that handles the non-sigalgs path, along with SSL_USE_SIGALGS() and the related flags. Also remove SIGALG_RSA_PKCS1_MD5_SHA1 and references to it, since this is also now unused. ok kenjiro@ tb@ --- src/lib/libssl/ssl_clnt.c | 140 +++++++--------------------------------- src/lib/libssl/ssl_local.h | 15 +---- src/lib/libssl/ssl_sigalgs.c | 19 +----- src/lib/libssl/ssl_sigalgs.h | 5 +- src/lib/libssl/ssl_srvr.c | 148 +++++++++++-------------------------------- 5 files changed, 66 insertions(+), 261 deletions(-) (limited to 'src/lib/libssl') diff --git a/src/lib/libssl/ssl_clnt.c b/src/lib/libssl/ssl_clnt.c index 6ef81a1706..b59ffa0eff 100644 --- a/src/lib/libssl/ssl_clnt.c +++ b/src/lib/libssl/ssl_clnt.c @@ -1,4 +1,4 @@ -/* $OpenBSD: ssl_clnt.c,v 1.171 2026/04/03 12:58:19 jsing Exp $ */ +/* $OpenBSD: ssl_clnt.c,v 1.172 2026/05/31 14:34:44 jsing Exp $ */ /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com) * All rights reserved. * @@ -1034,13 +1034,6 @@ ssl3_get_server_hello(SSL *s) if (!tls1_transcript_hash_init(s)) goto err; - /* - * Don't digest cached records if no sigalgs: we may need them for - * client authentication. - */ - if (!SSL_USE_SIGALGS(s)) - tls1_transcript_free(s); - if (!CBS_get_u8(&cbs, &compression_method)) goto decode_err; @@ -1384,10 +1377,9 @@ ssl3_get_server_key_exchange(SSL *s) goto fatal_err; } - if (SSL_USE_SIGALGS(s)) { - if (!CBS_get_u16(&cbs, &sigalg_value)) - goto decode_err; - } + if (!CBS_get_u16(&cbs, &sigalg_value)) + goto decode_err; + if (!CBS_get_u16_length_prefixed(&cbs, &signature)) goto decode_err; if (CBS_len(&signature) > EVP_PKEY_size(pkey)) { @@ -1448,7 +1440,7 @@ ssl3_get_server_key_exchange(SSL *s) static int ssl3_get_certificate_request(SSL *s) { - CBS cert_request, cert_types, rdn_list; + CBS cert_request, cert_types, rdn_list, sigalgs; X509_NAME *xn = NULL; const unsigned char *q; STACK_OF(X509_NAME) *ca_sk = NULL; @@ -1497,27 +1489,23 @@ ssl3_get_certificate_request(SSL *s) if (!CBS_get_u8_length_prefixed(&cert_request, &cert_types)) goto decode_err; - if (SSL_USE_SIGALGS(s)) { - CBS sigalgs; - - if (CBS_len(&cert_request) < 2) { - SSLerror(s, SSL_R_DATA_LENGTH_TOO_LONG); - goto err; - } - if (!CBS_get_u16_length_prefixed(&cert_request, &sigalgs)) { - ssl3_send_alert(s, SSL3_AL_FATAL, SSL_AD_DECODE_ERROR); - SSLerror(s, SSL_R_DATA_LENGTH_TOO_LONG); - goto err; - } - if (CBS_len(&sigalgs) % 2 != 0 || CBS_len(&sigalgs) > 64) { - ssl3_send_alert(s, SSL3_AL_FATAL, SSL_AD_DECODE_ERROR); - SSLerror(s, SSL_R_SIGNATURE_ALGORITHMS_ERROR); - goto err; - } - if (!CBS_stow(&sigalgs, &s->s3->hs.sigalgs, - &s->s3->hs.sigalgs_len)) - goto err; + if (CBS_len(&cert_request) < 2) { + SSLerror(s, SSL_R_DATA_LENGTH_TOO_LONG); + goto err; + } + if (!CBS_get_u16_length_prefixed(&cert_request, &sigalgs)) { + ssl3_send_alert(s, SSL3_AL_FATAL, SSL_AD_DECODE_ERROR); + SSLerror(s, SSL_R_DATA_LENGTH_TOO_LONG); + goto err; } + if (CBS_len(&sigalgs) % 2 != 0 || CBS_len(&sigalgs) > 64) { + ssl3_send_alert(s, SSL3_AL_FATAL, SSL_AD_DECODE_ERROR); + SSLerror(s, SSL_R_SIGNATURE_ALGORITHMS_ERROR); + goto err; + } + if (!CBS_stow(&sigalgs, &s->s3->hs.sigalgs, + &s->s3->hs.sigalgs_len)) + goto err; /* get the CA RDNs */ if (CBS_len(&cert_request) < 2) { @@ -2034,77 +2022,6 @@ ssl3_send_client_verify_sigalgs(SSL *s, EVP_PKEY *pkey, return ret; } -static int -ssl3_send_client_verify_rsa(SSL *s, EVP_PKEY *pkey, CBB *cert_verify) -{ - CBB cbb_signature; - RSA *rsa; - unsigned char data[EVP_MAX_MD_SIZE]; - unsigned char *signature = NULL; - unsigned int signature_len; - size_t data_len; - int ret = 0; - - if (!tls1_transcript_hash_value(s, data, sizeof(data), &data_len)) - goto err; - if ((signature = calloc(1, EVP_PKEY_size(pkey))) == NULL) - goto err; - if ((rsa = EVP_PKEY_get0_RSA(pkey)) == NULL) - goto err; - if (RSA_sign(NID_md5_sha1, data, data_len, signature, &signature_len, - rsa) <= 0 ) { - SSLerror(s, ERR_R_RSA_LIB); - goto err; - } - - if (!CBB_add_u16_length_prefixed(cert_verify, &cbb_signature)) - goto err; - if (!CBB_add_bytes(&cbb_signature, signature, signature_len)) - goto err; - if (!CBB_flush(cert_verify)) - goto err; - - ret = 1; - err: - free(signature); - return ret; -} - -static int -ssl3_send_client_verify_ec(SSL *s, EVP_PKEY *pkey, CBB *cert_verify) -{ - CBB cbb_signature; - EC_KEY *eckey; - unsigned char data[EVP_MAX_MD_SIZE]; - unsigned char *signature = NULL; - unsigned int signature_len; - int ret = 0; - - if (!tls1_transcript_hash_value(s, data, sizeof(data), NULL)) - goto err; - if ((signature = calloc(1, EVP_PKEY_size(pkey))) == NULL) - goto err; - if ((eckey = EVP_PKEY_get0_EC_KEY(pkey)) == NULL) - goto err; - if (!ECDSA_sign(0, &data[MD5_DIGEST_LENGTH], SHA_DIGEST_LENGTH, - signature, &signature_len, eckey)) { - SSLerror(s, ERR_R_ECDSA_LIB); - goto err; - } - - if (!CBB_add_u16_length_prefixed(cert_verify, &cbb_signature)) - goto err; - if (!CBB_add_bytes(&cbb_signature, signature, signature_len)) - goto err; - if (!CBB_flush(cert_verify)) - goto err; - - ret = 1; - err: - free(signature); - return ret; -} - static int ssl3_send_client_verify(SSL *s) { @@ -2130,20 +2047,9 @@ ssl3_send_client_verify(SSL *s) * For TLS v1.2 send signature algorithm and signature using * agreed digest and cached handshake records. */ - if (SSL_USE_SIGALGS(s)) { - if (!ssl3_send_client_verify_sigalgs(s, pkey, sigalg, - &cert_verify)) - goto err; - } else if (EVP_PKEY_id(pkey) == EVP_PKEY_RSA) { - if (!ssl3_send_client_verify_rsa(s, pkey, &cert_verify)) - goto err; - } else if (EVP_PKEY_id(pkey) == EVP_PKEY_EC) { - if (!ssl3_send_client_verify_ec(s, pkey, &cert_verify)) - goto err; - } else { - SSLerror(s, ERR_R_INTERNAL_ERROR); + if (!ssl3_send_client_verify_sigalgs(s, pkey, sigalg, + &cert_verify)) goto err; - } tls1_transcript_free(s); diff --git a/src/lib/libssl/ssl_local.h b/src/lib/libssl/ssl_local.h index ec8a52d703..df4c0dc357 100644 --- a/src/lib/libssl/ssl_local.h +++ b/src/lib/libssl/ssl_local.h @@ -1,4 +1,4 @@ -/* $OpenBSD: ssl_local.h,v 1.38 2026/05/25 09:09:34 jsing Exp $ */ +/* $OpenBSD: ssl_local.h,v 1.39 2026/05/31 14:34:44 jsing Exp $ */ /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com) * All rights reserved. * @@ -263,10 +263,6 @@ __BEGIN_HIDDEN_DECLS */ #define SSL_C_PKEYLENGTH(c) 1024 -/* See if we use signature algorithms extension. */ -#define SSL_USE_SIGALGS(s) \ - (s->method->enc_flags & SSL_ENC_FLAG_SIGALGS) - /* Allow TLS 1.2 ciphersuites: applies to DTLS 1.2 as well as TLS 1.2. */ #define SSL_USE_TLS1_2_CIPHERS(s) \ (s->method->enc_flags & SSL_ENC_FLAG_TLS1_2_CIPHERS) @@ -1163,9 +1159,6 @@ typedef struct ssl3_state_st { * Flag values for enc_flags. */ -/* Uses signature algorithms extension. */ -#define SSL_ENC_FLAG_SIGALGS (1 << 1) - /* Allow TLS 1.2 ciphersuites: applies to DTLS 1.2 as well as TLS 1.2. */ #define SSL_ENC_FLAG_TLS1_2_CIPHERS (1 << 4) @@ -1174,10 +1167,8 @@ typedef struct ssl3_state_st { #define TLSV1_ENC_FLAGS 0 #define TLSV1_1_ENC_FLAGS 0 -#define TLSV1_2_ENC_FLAGS (SSL_ENC_FLAG_SIGALGS | \ - SSL_ENC_FLAG_TLS1_2_CIPHERS) -#define TLSV1_3_ENC_FLAGS (SSL_ENC_FLAG_SIGALGS | \ - SSL_ENC_FLAG_TLS1_3_CIPHERS) +#define TLSV1_2_ENC_FLAGS SSL_ENC_FLAG_TLS1_2_CIPHERS +#define TLSV1_3_ENC_FLAGS SSL_ENC_FLAG_TLS1_3_CIPHERS extern const SSL_CIPHER ssl3_ciphers[]; diff --git a/src/lib/libssl/ssl_sigalgs.c b/src/lib/libssl/ssl_sigalgs.c index ee4088f6ab..779d47985a 100644 --- a/src/lib/libssl/ssl_sigalgs.c +++ b/src/lib/libssl/ssl_sigalgs.c @@ -1,4 +1,4 @@ -/* $OpenBSD: ssl_sigalgs.c,v 1.53 2026/03/30 06:20:08 tb Exp $ */ +/* $OpenBSD: ssl_sigalgs.c,v 1.54 2026/05/31 14:34:44 jsing Exp $ */ /* * Copyright (c) 2018-2020 Bob Beck * Copyright (c) 2021 Joel Sing @@ -133,12 +133,6 @@ const struct ssl_sigalg sigalgs[] = { .md = EVP_sha1, .security_level = 1, }, - { - .value = SIGALG_RSA_PKCS1_MD5_SHA1, - .key_type = EVP_PKEY_RSA, - .md = EVP_md5_sha1, - .security_level = 1, - }, { .value = SIGALG_NONE, }, @@ -237,9 +231,6 @@ ssl_sigalgs_build(uint16_t tls_version, CBB *cbb, int security_level) /* Add values in order as long as they are supported. */ for (i = 0; i < len; i++) { - /* Do not allow the legacy value for < 1.2 to be used. */ - if (values[i] == SIGALG_RSA_PKCS1_MD5_SHA1) - return 0; if ((sigalg = ssl_sigalg_lookup(values[i])) == NULL) return 0; if (sigalg->security_level < security_level) @@ -262,8 +253,6 @@ ssl_sigalg_for_legacy(SSL *s, EVP_PKEY *pkey) /* Default signature algorithms used for TLSv1.2 and earlier. */ switch (EVP_PKEY_id(pkey)) { case EVP_PKEY_RSA: - if (s->s3->hs.negotiated_tls_version < TLS1_2_VERSION) - return ssl_sigalg_lookup(SIGALG_RSA_PKCS1_MD5_SHA1); return ssl_sigalg_lookup(SIGALG_RSA_PKCS1_SHA1); case EVP_PKEY_EC: return ssl_sigalg_lookup(SIGALG_ECDSA_SHA1); @@ -317,9 +306,6 @@ ssl_sigalg_select(SSL *s, EVP_PKEY *pkey) { CBS cbs; - if (!SSL_USE_SIGALGS(s)) - return ssl_sigalg_for_legacy(s, pkey); - /* * RFC 5246 allows a TLS 1.2 client to send no sigalgs extension, * in which case the server must use the default. @@ -353,9 +339,6 @@ ssl_sigalg_for_peer(SSL *s, EVP_PKEY *pkey, uint16_t sigalg_value) { const struct ssl_sigalg *sigalg; - if (!SSL_USE_SIGALGS(s)) - return ssl_sigalg_for_legacy(s, pkey); - if ((sigalg = ssl_sigalg_from_value(s, sigalg_value)) == NULL) { SSLerror(s, SSL_R_UNKNOWN_DIGEST); return NULL; diff --git a/src/lib/libssl/ssl_sigalgs.h b/src/lib/libssl/ssl_sigalgs.h index 5211ec6b62..775842a093 100644 --- a/src/lib/libssl/ssl_sigalgs.h +++ b/src/lib/libssl/ssl_sigalgs.h @@ -1,4 +1,4 @@ -/* $OpenBSD: ssl_sigalgs.h,v 1.27 2024/02/03 15:58:34 beck Exp $ */ +/* $OpenBSD: ssl_sigalgs.h,v 1.28 2026/05/31 14:34:44 jsing Exp $ */ /* * Copyright (c) 2018-2019 Bob Beck * @@ -47,9 +47,6 @@ __BEGIN_HIDDEN_DECLS #define SIGALG_PRIVATE_START 0xFE00 #define SIGALG_PRIVATE_END 0xFFFF -/* Legacy sigalg for < TLSv1.2 same value as BoringSSL uses. */ -#define SIGALG_RSA_PKCS1_MD5_SHA1 0xFF01 - #define SIGALG_FLAG_RSA_PSS 0x00000001 struct ssl_sigalg { diff --git a/src/lib/libssl/ssl_srvr.c b/src/lib/libssl/ssl_srvr.c index af4b20f6ce..f9c4ef918a 100644 --- a/src/lib/libssl/ssl_srvr.c +++ b/src/lib/libssl/ssl_srvr.c @@ -1,4 +1,4 @@ -/* $OpenBSD: ssl_srvr.c,v 1.168 2026/04/03 12:58:19 jsing Exp $ */ +/* $OpenBSD: ssl_srvr.c,v 1.169 2026/05/31 14:34:44 jsing Exp $ */ /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com) * All rights reserved. * @@ -568,33 +568,14 @@ ssl3_accept(SSL *s) } alg_k = s->s3->hs.cipher->algorithm_mkey; - if (SSL_USE_SIGALGS(s)) { - s->s3->hs.state = SSL3_ST_SR_CERT_VRFY_A; - s->init_num = 0; - if (!s->session->peer_cert) - break; + s->s3->hs.state = SSL3_ST_SR_CERT_VRFY_A; + s->init_num = 0; + if (s->session->peer_cert != NULL) { /* * Freeze the transcript for use during client * certificate verification. */ tls1_transcript_freeze(s); - } else { - s->s3->hs.state = SSL3_ST_SR_CERT_VRFY_A; - s->init_num = 0; - - tls1_transcript_free(s); - - /* - * We need to get hashes here so if there is - * a client cert, it can be verified. - */ - if (!tls1_transcript_hash_value(s, - s->s3->hs.tls12.cert_verify, - sizeof(s->s3->hs.tls12.cert_verify), - NULL)) { - ret = -1; - goto end; - } } break; @@ -1142,7 +1123,7 @@ ssl3_get_client_hello(SSL *s) if (!tls1_transcript_hash_init(s)) goto err; - if (!SSL_USE_SIGALGS(s) || !(s->verify_mode & SSL_VERIFY_PEER)) + if (!(s->verify_mode & SSL_VERIFY_PEER)) tls1_transcript_free(s); /* @@ -1501,12 +1482,10 @@ ssl3_send_server_key_exchange(SSL *s) s->s3->hs.our_sigalg = sigalg; /* Send signature algorithm. */ - if (SSL_USE_SIGALGS(s)) { - if (!CBB_add_u16(&server_kex, sigalg->value)) { - al = SSL_AD_INTERNAL_ERROR; - SSLerror(s, ERR_R_INTERNAL_ERROR); - goto fatal_err; - } + if (!CBB_add_u16(&server_kex, sigalg->value)) { + al = SSL_AD_INTERNAL_ERROR; + SSLerror(s, ERR_R_INTERNAL_ERROR); + goto fatal_err; } if (!EVP_DigestSignInit(md_ctx, &pctx, md, NULL, pkey)) { @@ -1591,14 +1570,11 @@ ssl3_send_certificate_request(SSL *s) if (!ssl3_get_req_cert_types(s, &cert_types)) goto err; - if (SSL_USE_SIGALGS(s)) { - if (!CBB_add_u16_length_prefixed(&cert_request, - &sigalgs)) - goto err; - if (!ssl_sigalgs_build(s->s3->hs.negotiated_tls_version, - &sigalgs, SSL_get_security_level(s))) - goto err; - } + if (!CBB_add_u16_length_prefixed(&cert_request, &sigalgs)) + goto err; + if (!ssl_sigalgs_build(s->s3->hs.negotiated_tls_version, + &sigalgs, SSL_get_security_level(s))) + goto err; if (!CBB_add_u16_length_prefixed(&cert_request, &cert_auth)) goto err; @@ -1879,7 +1855,8 @@ ssl3_get_cert_verify(SSL *s) EVP_PKEY *pkey; X509 *peer_cert = NULL; EVP_MD_CTX *mctx = NULL; - int al, verify; + EVP_PKEY_CTX *pctx; + int al; const unsigned char *hdata; size_t hdatalen; int type = 0; @@ -1932,10 +1909,9 @@ ssl3_get_cert_verify(SSL *s) goto fatal_err; } - if (SSL_USE_SIGALGS(s)) { - if (!CBS_get_u16(&cbs, &sigalg_value)) - goto decode_err; - } + if (!CBS_get_u16(&cbs, &sigalg_value)) + goto decode_err; + if (!CBS_get_u16_length_prefixed(&cbs, &signature)) goto err; if (CBS_len(&cbs) != 0) { @@ -1957,74 +1933,26 @@ ssl3_get_cert_verify(SSL *s) } s->s3->hs.peer_sigalg = sigalg; - if (SSL_USE_SIGALGS(s)) { - EVP_PKEY_CTX *pctx; - - if (!tls1_transcript_data(s, &hdata, &hdatalen)) { - SSLerror(s, ERR_R_INTERNAL_ERROR); - al = SSL_AD_INTERNAL_ERROR; - goto fatal_err; - } - if (!EVP_DigestVerifyInit(mctx, &pctx, sigalg->md(), - NULL, pkey)) { - SSLerror(s, ERR_R_EVP_LIB); - al = SSL_AD_INTERNAL_ERROR; - goto fatal_err; - } - if ((sigalg->flags & SIGALG_FLAG_RSA_PSS) && - (!EVP_PKEY_CTX_set_rsa_padding(pctx, - RSA_PKCS1_PSS_PADDING) || - !EVP_PKEY_CTX_set_rsa_pss_saltlen(pctx, -1))) { - al = SSL_AD_INTERNAL_ERROR; - goto fatal_err; - } - if (EVP_DigestVerify(mctx, CBS_data(&signature), - CBS_len(&signature), hdata, hdatalen) <= 0) { - SSLerror(s, ERR_R_EVP_LIB); - al = SSL_AD_INTERNAL_ERROR; - goto fatal_err; - } - } else if (EVP_PKEY_id(pkey) == EVP_PKEY_RSA) { - RSA *rsa; - - if ((rsa = EVP_PKEY_get0_RSA(pkey)) == NULL) { - al = SSL_AD_INTERNAL_ERROR; - SSLerror(s, ERR_R_EVP_LIB); - goto fatal_err; - } - verify = RSA_verify(NID_md5_sha1, s->s3->hs.tls12.cert_verify, - MD5_DIGEST_LENGTH + SHA_DIGEST_LENGTH, CBS_data(&signature), - CBS_len(&signature), rsa); - if (verify < 0) { - al = SSL_AD_DECRYPT_ERROR; - SSLerror(s, SSL_R_BAD_RSA_DECRYPT); - goto fatal_err; - } - if (verify == 0) { - al = SSL_AD_DECRYPT_ERROR; - SSLerror(s, SSL_R_BAD_RSA_SIGNATURE); - goto fatal_err; - } - } else if (EVP_PKEY_id(pkey) == EVP_PKEY_EC) { - EC_KEY *eckey; - - if ((eckey = EVP_PKEY_get0_EC_KEY(pkey)) == NULL) { - al = SSL_AD_INTERNAL_ERROR; - SSLerror(s, ERR_R_EVP_LIB); - goto fatal_err; - } - verify = ECDSA_verify(0, - &(s->s3->hs.tls12.cert_verify[MD5_DIGEST_LENGTH]), - SHA_DIGEST_LENGTH, CBS_data(&signature), - CBS_len(&signature), eckey); - if (verify <= 0) { - al = SSL_AD_DECRYPT_ERROR; - SSLerror(s, SSL_R_BAD_ECDSA_SIGNATURE); - goto fatal_err; - } - } else { + if (!tls1_transcript_data(s, &hdata, &hdatalen)) { SSLerror(s, ERR_R_INTERNAL_ERROR); - al = SSL_AD_UNSUPPORTED_CERTIFICATE; + al = SSL_AD_INTERNAL_ERROR; + goto fatal_err; + } + if (!EVP_DigestVerifyInit(mctx, &pctx, sigalg->md(), NULL, pkey)) { + SSLerror(s, ERR_R_EVP_LIB); + al = SSL_AD_INTERNAL_ERROR; + goto fatal_err; + } + if ((sigalg->flags & SIGALG_FLAG_RSA_PSS) && + (!EVP_PKEY_CTX_set_rsa_padding(pctx, RSA_PKCS1_PSS_PADDING) || + !EVP_PKEY_CTX_set_rsa_pss_saltlen(pctx, -1))) { + al = SSL_AD_INTERNAL_ERROR; + goto fatal_err; + } + if (EVP_DigestVerify(mctx, CBS_data(&signature), CBS_len(&signature), + hdata, hdatalen) <= 0) { + SSLerror(s, ERR_R_EVP_LIB); + al = SSL_AD_INTERNAL_ERROR; goto fatal_err; } -- cgit v1.2.3-55-g6feb